CVE-2023-30179
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.2epss 2.2%
CraftCMS version 3.7.59 is vulnerable to Server-Side Template Injection (SSTI). An authenticated attacker can inject Twig Template to User Photo Location field when setting User Photo Location in User Settings, lead to Remote Code Execution. NOTE: the vendor disputes this because only Administrators can add this Twig code, and (by design) Administrators are allowed to do that by default.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
n/a · n/aReferências
https://datnlq.gitbook.io/cve/craft-cms/cve-2023-30179-server-side-template-injectionhttps://github.com/craftcms/cms/blob/develop/CHANGELOG.md#442---2023-03-14https://github.com/github/advisory-database/pull/2443#issuecomment-1610040714https://github.com/github/advisory-database/pull/2443#issuecomment-1610634200